Fail2ban 防止暴力破解centos服务器的SSH或者FTP账户

/etc/fail2ban/action.d#动作文件夹，内含默认文件。iptables以及mail等动作配置

/etc/fail2ban/fail2ban.conf#定义了fai2ban日志级别、日志位置及sock文件位置

/etc/fail2ban/filter.d#条件文件夹，内含默认文件。过滤日志关键内容设置

/etc/fail2ban/jail.conf#主要配置文件，模块化。主要设置启用ban动作的服务及动作阀值

/etc/rc.d/init.d/fail2ban#启动脚本文件

vi/etc/fail2ban/fail2ban.conf

[Definition]

loglevel=3

logtarget=SYSLOG#我们需要做的就是把这行改成/var/log/fail2ban.log，方便用来记录日志信息

socket=/var/run/fail2ban/fail2ban.sock

centosJobforfail2ban.servicefailedbecausethecontrolprocessexitedwitherrorcode.See"systemctlstatusfail2ban.service"and"journalctl-xe"fordetails

[DEFAULT]#全局设置

ignoreip=127.0.0.1#忽略的IP列表,不受设置限制，多个以空格隔开

bantime=600#屏蔽时间，单位：秒

findtime=600#这个时间段内超过规定次数会被ban掉

maxretry=3#最大尝试次数

backend=auto#日志修改检测机制（gamin、polling和auto这三种）

[sshd]#单个服务检查设置，如设置bantime、findtime、maxretry和全局冲突，服务优先级大于全局设置。

enabled=true#是否激活此项（true/false）

filter=sshd#过滤规则filter的名字，对应filter.d目录下的sshd.conf

action=iptables[name=SSH,port=ssh,protocol=tcp]#动作的相关参数，对应action.d/iptables.conf文件

logpath=/var/log/secure#检测的日志文件path

bantime=3600

findtime=300

maxretry=3

[ssh-iptables]

enabled=true

filter=sshd

action=iptables[name=SSH,port=ssh,protocol=tcp]

sendmail-whois[name=SSH,dest=root,sender=fail2ban@example.com,sendername="Fail2Ban"]

logpath=/var/log/secure

maxretry=5

[ssh-ddos]

enabled=true

filter=sshd-ddos

action=iptables[name=ssh-ddos,port=ssh,sftpprotocol=tcp,udp]

logpath=/var/log/messages

maxretry=2

[osx-ssh-ipfw]

enabled=true

filter=sshd

action=osx-ipfw

logpath=/var/log/secure.log

maxretry=5

[ssh-apf]

enabled=true

filter=sshd

action=apf[name=SSH]

logpath=/var/log/secure

maxretry=5

[osx-ssh-afctl]

enabled=true

filter=sshd

action=osx-afctl[bantime=600]

logpath=/var/log/secure.log

maxretry=5

[selinux-ssh]

enabled=true

filter=selinux-ssh

action=iptables[name=SELINUX-SSH,port=ssh,protocol=tcp]

logpath=/var/log/audit/audit.log

maxretry=5

[proftpd-iptables]

enabled=true

filter=proftpd

action=iptables[name=ProFTPD,port=ftp,protocol=tcp]

sendmail-whois[name=ProFTPD,dest=you@example.com]

logpath=/var/log/proftpd/proftpd.log

maxretry=6

[sasl-iptables]

enabled=true

filter=postfix-sasl

backend=polling

action=iptables[name=sasl,port=smtp,protocol=tcp]

sendmail-whois[name=sasl,dest=you@example.com]

logpath=/var/log/mail.log

[dovecot]

enabled=true

filter=dovecot

action=iptables-multiport[name=dovecot,port="pop3,pop3s,imap,imaps,submission,smtps,sieve",protocol=tcp]

logpath=/var/log/mail.log

[dovecot-auth]

enabled=true

filter=dovecot

action=iptables-multiport[name=dovecot-auth,port="pop3,pop3s,imap,imaps,submission,smtps,sieve",protocol=tcp]

logpath=/var/log/secure

[perdition]

enabled=true

filter=perdition

action=iptables-multiport[name=perdition,port="110,143,993,995"]

logpath=/var/log/maillog

[uwimap-auth]

enabled=true

filter=uwimap-auth

action=iptables-multiport[name=uwimap-auth,port="110,143,993,995"]

logpath=/var/log/maillog

[apache-tcpwrapper]

enabled=true

filter=apache-auth

action=hostsdeny

logpath=/var/log/httpd/error_log

maxretry=6

[apache-badbots]

enabled=true

filter=apache-badbots

action=iptables-multiport[name=BadBots,port="http,https"]

sendmail-buffered[name=BadBots,lines=5,dest=you@example.com]

logpath=/var/log/httpd/access_log

bantime=172800

maxretry=1

[apache-shorewall]

enabled=true

filter=apache-noscript

action=shorewall

sendmail[name=Postfix,dest=you@example.com]

logpath=/var/log/httpd/error_log

[nginx-http-auth]

enabled=true

filter=nginx-http-auth

action=iptables-multiport[name=nginx-http-auth,port="80,443"]

logpath=/var/log/nginx/error.log

[suhosin]

enabled=true

filter=suhosin

action=iptables-multiport[name=suhosin,port="http,https"]

#adaptthefollowingtwoitemsasneeded

logpath=/var/log/lighttpd/error.log

maxretry=2

[lighttpd-auth]

enabled=true

filter=lighttpd-auth

action=iptables-multiport[name=lighttpd-auth,port="http,https"]

#adaptthefollowingtwoitemsasneeded

logpath=/var/log/lighttpd/error.log

maxretry=2

[vsftpd-notification]

enabled=true

filter=vsftpd

action=sendmail-whois[name=VSFTPD,dest=you@example.com]

logpath=/var/log/vsftpd.log

maxretry=5

bantime=1800

[vsftpd-iptables]

enabled=true

filter=vsftpd

action=iptables[name=VSFTPD,port=ftp,protocol=tcp]

sendmail-whois[name=VSFTPD,dest=you@example.com]

logpath=/var/log/vsftpd.log

maxretry=5

bantime=1800

[pure-ftpd]

enabled=true

filter=pure-ftpd

action=iptables[name=pure-ftpd,port=ftp,protocol=tcp]

logpath=/var/log/pureftpd.log

maxretry=2

bantime=86400

[mysqld-iptables]

enabled=true

filter=mysqld-auth

action=iptables[name=mysql,port=3306,protocol=tcp]

sendmail-whois[name=MySQL,dest=root,sender=fail2ban@example.com]

logpath=/var/log/mysqld.log

maxretry=5

[apache-phpmyadmin]

enabled=true

filter=apache-phpmyadmin

action=iptables[name=phpmyadmin,port=http,httpsprotocol=tcp]

logpath=/var/log/httpd/error_log

maxretry=3

#/etc/fail2ban/filter.d/apache-phpmyadmin.conf

将以下内容粘贴到apache-phpmyadmin.conf里保存即可以创建一个apache-phpmyadmin.conf文件.

#Fail2Banconfigurationfile

#

#Bansbotsscanningfornon-existingphpMyAdmininstallationsonyourwebhost.

#

#Author:GinaHaeussge

#

[Definition]

docroot=/var/www

badadmin=PMA|phpmyadmin|myadmin|mysql|mysqladmin|sqladmin|mypma|admin|xampp|mysqldb|mydb|db|pmadb|phpmyadmin1|phpmyadmin2

#Option:failregex

#Notes.:Regexptomatchoftenprobedandnotavailablephpmyadminpaths.

#Values:TEXT

#

failregex=[[]client[]]Filedoesnotexist:%(docroot)s/(?:%(badadmin)s)

#Option:ignoreregex

#Notes.:regextoignore.Ifthisregexmatches,thelineisignored.

#Values:TEXT

#

ignoreregex=

#servicefail2banrestart

[nginx];规则名字

enabled=true;是否户用

port=http,https;监控端口

filter=nginx;需要过滤匹配规则

logpath=/var/log/nginx/access_log;日志路径

findtime=60;检测周期单位秒以下一样

bantime=300;iptable封禁IP时间

maxretry=10;最大尝试次数

action=iptables[name=nginx,port=http,protocal=tcp];发现暴力破解采取iptalbes封禁IP的措施

sendmail[name=nginx,dest=my-email@xx.com];发现暴力破解后采取sendmail发送邮件的措施，需要注意的是：iptables和sendmail必须对齐，要不然会发生错误；不要问我为什么会知道。

[Definition]

failregex=<HOST>.*-.*-.*POST.*/login_check.do.*HTTP\/1.*http://test.com.*$;需要匹配日志发现攻击行为的正则,<HOST>为fail2ban内置变量匹配IP，不可修改

ignoreregex=;需要忽略的正则

[root@bogon~]#iptables-L--line-numbers

ChainINPUT(policyACCEPT)

numtargetprotoptsourcedestination

1f2b-SSHtcp--anywhereanywheretcpdpt:ssh

2f2b-SSHtcp--anywhereanywheretcpdpt:ssh

3ACCEPTudp--anywhereanywhereudpdpt:domain

4ACCEPTtcp--anywhereanywheretcpdpt:domain

5ACCEPTudp--anywhereanywhereudpdpt:bootps

6ACCEPTtcp--anywhereanywheretcpdpt:bootps

7ACCEPTall--anywhereanywherectstateRELATED,ESTABLISHED

8ACCEPTall--anywhereanywhere

9INPUT_directall--anywhereanywhere

10INPUT_ZONES_SOURCEall--anywhereanywhere

11INPUT_ZONESall--anywhereanywhere

12ACCEPTicmp--anywhereanywhere

13REJECTall--anywhereanywherereject-withicmp-host-prohibited

Chainf2b-SSH(2references)

numtargetprotoptsourcedestination

1REJECTall--58.218.211.38anywherereject-withicmp-port-unreachable

2RETURNall--anywhereanywhere

Youhavenewmailin/var/spool/mail/root

#iptables-L--line-numbers

Chainf2b-SSH(2references)

numtargetprotoptsourcedestination

1REJECTall--58.218.211.38anywherereject-withicmp-port-unreachable

2RETURNall--anywhereanywhere

#iptables-Df2b-SSH1

上面是解除第一个拒绝的IP

[root@bogon~]#find/var/log-name'secure*'-typef|whilereadline;doawk'/Failed/{print$(NF-3)}'$line;done|awk'{a[$0]++}END{for(jina)if(a[j]>20)printj"="a[j]}'|sort-n-t'='-k2

202.99.172.155=24

123.126.110.69=25

222.74.228.85=136

5.189.139.232=557

222.178.229.67=1005

222.186.15.82=1883

59.63.188.44=6748

58.218.211.38=6752

[root@bogon~]#

rootpass=`date+%s|sha256sum|base64|head-c24`&&echoroot:$rootpass|chpasswd&&echo$rootpass